任务执行1-19

internal/ingest/replay_test.go

@@ -0,0 +1,61 @@
+package ingest
+
+import (
+	"encoding/json"
+	"testing"
+
+	"git.apinb.com/ops/logs/internal/models"
+)
+
+func TestSyslogRuleMatchDetailsExtractsResourceUID(t *testing.T) {
+	rule := models.SyslogRule{
+		Name:                    "H3C link down",
+		Enabled:                 true,
+		SourceMatch:             "h3c-core",
+		MessageRegex:            `Interface (?P<iface>GigabitEthernet[0-9/]+) is down`,
+		ResourceUIDExtractRegex: `Interface (?P<resource_uid>GigabitEthernet[0-9/]+) is down`,
+	}
+
+	match := syslogRuleMatchDetails(&rule, "h3c-core-01", "Interface GigabitEthernet1/0/1 is down", "")
+	if !match.Matched {
+		t.Fatal("expected rule to match")
+	}
+	if match.ResourceUID != "network:GigabitEthernet1/0/1" {
+		t.Fatalf("unexpected resource uid: %q", match.ResourceUID)
+	}
+}
+
+func TestBuildReplayRawEventPayloadMarksReplayed(t *testing.T) {
+	ev := models.LogEvent{
+		ID:                12,
+		SourceKind:        "syslog",
+		SourceIP:          "10.1.2.3",
+		RemoteAddr:        "10.1.2.3:514",
+		DeviceName:        "h3c-core-01",
+		RawPayload:        "<189>Jun 24 10:00:01 h3c-core-01 IFNET/4/LINK_DOWN: Interface GigabitEthernet1/0/1 is down",
+		NormalizedSummary: "h3c-core-01: Interface GigabitEthernet1/0/1 is down",
+		SeverityCode:      "warning",
+		DispatchStatus:    "pending",
+	}
+
+	body, err := BuildReplayRawEventPayload(ev)
+	if err != nil {
+		t.Fatalf("BuildReplayRawEventPayload returned error: %v", err)
+	}
+	if body.SourceType != "syslog" {
+		t.Fatalf("unexpected source type: %q", body.SourceType)
+	}
+	if body.ParseStatus != "replayed" {
+		t.Fatalf("unexpected parse status: %q", body.ParseStatus)
+	}
+	if body.Labels["replay_of_log_event_id"] != "12" {
+		t.Fatalf("missing replay label: %#v", body.Labels)
+	}
+	var raw map[string]any
+	if err := json.Unmarshal(body.RawPayload, &raw); err != nil {
+		t.Fatalf("raw payload should be json: %v", err)
+	}
+	if raw["raw_packet"] == "" {
+		t.Fatalf("raw packet missing: %#v", raw)
+	}
+}